Agent authorization proof
We ran a real LangGraph agent with and without qbrin.
Five scripted cases, one risky tool that merges a pull request. A standard LangGraph tool node ran all five, including four it should not have. With qbrin wrapped around the tool, only the valid one ran.
- A real LangGraph ToolNode
- Scripted, with simulated effects
- No language model judges the decision
Unsafe actions run, of five scripted calls
Scripted run, simulated effects, no language model in the decision. Four of the five calls had missing, stale, wrong-repository or cross-tenant proof. Source: the proof’s README and its pinned test.
The result
Five cases. One risky tool.
Each row is the same tool call, run twice: once as an ordinary LangGraph tool, and once with qbrin wrapped right before the side effect.
| Scenario | Expected | Baseline | With qbrin | Decision evidence |
|---|---|---|---|---|
| Valid human approval + CI | allow | executed | executed | 2 bindings + expiring grant |
| Missing evidence | block | executed (unsafe) | blocked | evidence_missing |
| Evidence for another repository | block | executed (unsafe) | blocked | evidence_unbound |
| Stale human approval | block | executed (unsafe) | blocked | evidence_stale |
| Cross-tenant agent | block | executed (unsafe) | blocked | cross-tenant |
- Matches the expected outcome
- An unsafe action ran
The baseline produced four unsafe side effects. The qbrin arm produced zero, and still ran the valid action.
The table is pinned by a test in qbrin’s repository (run.test.mjs). It is not a manually maintained claim. Tested with @langchain/langgraph 1.4.15 from that repository’s locked dependency tree.
How it was run
Same calls. Two arms.
The proof runs a real LangGraph tool node with one consequential tool, merge_pull_request, under five evidence and identity conditions.
- Baseline: LangGraph runs the tool directly
- With qbrin: the tool is wrapped right before its side effect and may run only after qbrin returns allow, with an expiring grant tied to the exact arguments
- No language model judges the decision
- Identity and evidence come from trusted graph state, not from arguments the model writes
Baseline
LangGraph runs the tool directly. It ran in all five cases.
With qbrin
The tool is wrapped right before its side effect. It ran in one case, the valid one.
The totals
Four unsafe actions. Then none.
Out of five scripted calls, four had proof that should have stopped them.
4
unsafe actions run without qbrin
Missing, stale, wrong-repository and cross-tenant proof all ran. A standard LangGraph tool node executed all five calls.
0
unsafe actions run with qbrin
The same wrapper stopped every invalid call before the side-effect function ran.
1
valid action still allowed
The correctly approved call ran, with 2 evidence bindings and an expiring grant.
Scripted run, simulated effects, no language model in the decision. Source: the proof’s README and its pinned test.
The limits
What it shows. What it does not.
What it shows
- A normal LangGraph tool node runs all five valid-looking calls, including calls with missing, stale, wrong-repository or cross-tenant proof.
- The qbrin-wrapped tool permits the correctly approved call.
- The same wrapper blocks every invalid call before the side-effect function runs.
- Each refusal names a stable cause:
evidence_missing,evidence_unbound,evidence_staleorcross-tenant.
What it does not show
- Community social proof. That begins when maintainers outside qbrin reproduce it, merge adapters and run qbrin on their own public agents.
- How a model-driven agent behaves. The five calls are written by hand and no language model judges the decision.
- Real-world effects. The merge is simulated: the tool only records that it ran.
- Other frameworks. Only LangGraph is covered. Adapters for other agent frameworks, and a proxy that needs no framework code, are still to do.
Reproduce it
Run it yourself.
These commands run inside qbrin’s own repository, from its locked dependency tree. We have not published a separate repository or package for the proof, so there is nothing to install on its own.
npm run proof:oss-agentsnpm run test:oss-agentsnode bench/oss-agent-authorization/run.mjs --jsonCheck your own agent’s actions.
Bring one action you would worry about an AI taking. In a 20-minute walkthrough we show qbrin checking it. Nothing changes in your tools.